Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Move Kerberos FAST config flag to shared kerberos config #26141

Merged
merged 18 commits into from
Jun 16, 2021
Merged

Move Kerberos FAST config flag to shared kerberos config #26141

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
6cf86a1
move the kerberos FAST flag up to the kerberos configuration, support…
faec Jun 4, 2021
635b266
Merge branch 'master' into kafka-kerberos
faec Jun 4, 2021
5eb4e36
update config templates
faec Jun 4, 2021
f4c4283
make update
faec Jun 4, 2021
0928219
oops, remove spurious file
faec Jun 4, 2021
ccbb5ba
Merge branch 'master' into kafka-kerberos
faec Jun 7, 2021
7bdae77
fix location of flag in docs
faec Jun 7, 2021
4d0d86c
make update
faec Jun 7, 2021
8e69bfd
add kerberos FAST flag to the real shared config doc
faec Jun 7, 2021
68aaaaa
revert spurious whitespace
faec Jun 7, 2021
99dd270
Merge branch 'master' into kafka-kerberos
faec Jun 8, 2021
8add6fa
make update
faec Jun 8, 2021
69479c7
go mod tidy
faec Jun 8, 2021
81ad67c
Merge branch 'master' into kafka-kerberos
faec Jun 9, 2021
3237775
Merge branch 'master' into kafka-kerberos
faec Jun 10, 2021
8913238
Merge branch 'master' into kafka-kerberos
faec Jun 14, 2021
2d01739
Merge branch 'master' into kafka-kerberos
faec Jun 14, 2021
a56f87a
Merge remote-tracking branch 'upstream/master' into kafka-kerberos
faec Jun 15, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions auditbeat/auditbeat.reference.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -594,6 +594,7 @@ output.elasticsearch:
# Kerberos realm.
#kerberos.realm: ELASTIC


# ------------------------------ Logstash Output -------------------------------
#output.logstash:
# Boolean flag to enable or disable the output module.
Expand Down Expand Up @@ -852,10 +853,6 @@ output.elasticsearch:
# purposes. The default is "beats".
#client_id: beats

# Enables Kerberos FAST authentication in the Kafka output. This may
# conflict with certain Active Directory configurations.
#enable_krb5_fast: false

# Use SSL settings for HTTPS.
#ssl.enabled: true

Expand Down Expand Up @@ -934,6 +931,10 @@ output.elasticsearch:
# Kerberos realm.
#kerberos.realm: ELASTIC

# Enables Kerberos FAST authentication. This may
# conflict with certain Active Directory configurations.
#kerberos.enable_krb5_fast: false

# -------------------------------- Redis Output --------------------------------
#output.redis:
# Boolean flag to enable or disable the output module.
Expand Down
9 changes: 5 additions & 4 deletions filebeat/filebeat.reference.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1497,6 +1497,7 @@ output.elasticsearch:
# Kerberos realm.
#kerberos.realm: ELASTIC


# ------------------------------ Logstash Output -------------------------------
#output.logstash:
# Boolean flag to enable or disable the output module.
Expand Down Expand Up @@ -1755,10 +1756,6 @@ output.elasticsearch:
# purposes. The default is "beats".
#client_id: beats

# Enables Kerberos FAST authentication in the Kafka output. This may
# conflict with certain Active Directory configurations.
#enable_krb5_fast: false

# Use SSL settings for HTTPS.
#ssl.enabled: true

Expand Down Expand Up @@ -1837,6 +1834,10 @@ output.elasticsearch:
# Kerberos realm.
#kerberos.realm: ELASTIC

# Enables Kerberos FAST authentication. This may
# conflict with certain Active Directory configurations.
#kerberos.enable_krb5_fast: false

# -------------------------------- Redis Output --------------------------------
#output.redis:
# Boolean flag to enable or disable the output module.
Expand Down
1 change: 1 addition & 0 deletions filebeat/input/kafka/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -193,6 +193,7 @@ func newSaramaConfig(config kafkaInputConfig) (*sarama.Config, error) {
Username: config.Kerberos.Username,
Password: config.Kerberos.Password,
Realm: config.Kerberos.Realm,
DisablePAFXFAST: !config.Kerberos.EnableFAST,
}
}

Expand Down
9 changes: 5 additions & 4 deletions heartbeat/heartbeat.reference.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -772,6 +772,7 @@ output.elasticsearch:
# Kerberos realm.
#kerberos.realm: ELASTIC


# ------------------------------ Logstash Output -------------------------------
#output.logstash:
# Boolean flag to enable or disable the output module.
Expand Down Expand Up @@ -1030,10 +1031,6 @@ output.elasticsearch:
# purposes. The default is "beats".
#client_id: beats

# Enables Kerberos FAST authentication in the Kafka output. This may
# conflict with certain Active Directory configurations.
#enable_krb5_fast: false

# Use SSL settings for HTTPS.
#ssl.enabled: true

Expand Down Expand Up @@ -1112,6 +1109,10 @@ output.elasticsearch:
# Kerberos realm.
#kerberos.realm: ELASTIC

# Enables Kerberos FAST authentication. This may
# conflict with certain Active Directory configurations.
#kerberos.enable_krb5_fast: false

# -------------------------------- Redis Output --------------------------------
#output.redis:
# Boolean flag to enable or disable the output module.
Expand Down
9 changes: 5 additions & 4 deletions journalbeat/journalbeat.reference.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -537,6 +537,7 @@ output.elasticsearch:
# Kerberos realm.
#kerberos.realm: ELASTIC


# ------------------------------ Logstash Output -------------------------------
#output.logstash:
# Boolean flag to enable or disable the output module.
Expand Down Expand Up @@ -795,10 +796,6 @@ output.elasticsearch:
# purposes. The default is "beats".
#client_id: beats

# Enables Kerberos FAST authentication in the Kafka output. This may
# conflict with certain Active Directory configurations.
#enable_krb5_fast: false

# Use SSL settings for HTTPS.
#ssl.enabled: true

Expand Down Expand Up @@ -877,6 +874,10 @@ output.elasticsearch:
# Kerberos realm.
#kerberos.realm: ELASTIC

# Enables Kerberos FAST authentication. This may
# conflict with certain Active Directory configurations.
#kerberos.enable_krb5_fast: false

# -------------------------------- Redis Output --------------------------------
#output.redis:
# Boolean flag to enable or disable the output module.
Expand Down
1 change: 1 addition & 0 deletions libbeat/_meta/config/output-elasticsearch.reference.yml.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,3 +98,4 @@ output.elasticsearch:

# Kerberos realm.
#kerberos.realm: ELASTIC

8 changes: 4 additions & 4 deletions libbeat/_meta/config/output-kafka.reference.yml.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,10 +131,6 @@
# purposes. The default is "beats".
#client_id: beats

# Enables Kerberos FAST authentication in the Kafka output. This may
# conflict with certain Active Directory configurations.
#enable_krb5_fast: false

{{include "ssl.reference.yml.tmpl" . | indent 2 }}
# Enable Kerberos support. Kerberos is automatically enabled if any Kerberos setting is set.
#kerberos.enabled: true
Expand All @@ -160,3 +156,7 @@

# Kerberos realm.
#kerberos.realm: ELASTIC

# Enables Kerberos FAST authentication. This may
# conflict with certain Active Directory configurations.
#kerberos.enable_krb5_fast: false
1 change: 1 addition & 0 deletions libbeat/common/transport/kerberos/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@ type Config struct {
Username string `config:"username"`
Password string `config:"password"`
Realm string `config:"realm" validate:"required"`
EnableFAST bool `config:"enable_krb5_fast"`
}

// IsEnabled returns true if the `enable` field is set to true in the yaml.
Expand Down
5 changes: 5 additions & 0 deletions libbeat/docs/shared-kerberos-config.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,3 +86,8 @@ This option can only be configured for Kafka. It is the name of the Kafka servic
==== `realm`

Name of the realm where the output resides.

[float]
==== `enable_krb5_fast`

Enable Kerberos FAST authentication. This may conflict with some Active Directory installations. The default is `false`.
9 changes: 8 additions & 1 deletion libbeat/outputs/kafka/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,6 +201,13 @@ func newSaramaConfig(log *logp.Logger, config *kafkaConfig) (*sarama.Config, err
case config.Kerberos.IsEnabled():
cfgwarn.Beta("Kerberos authentication for Kafka is beta.")

// Due to a regrettable past decision, the flag controlling Kerberos
// FAST authentication was initially added to the output configuration
// rather than the shared Kerberos configuration. To avoid a breaking
// change, we still check for the old flag, but it is deprecated and
// should be removed in a future version.
enableFAST := config.Kerberos.EnableFAST || config.EnableFAST

k.Net.SASL.Enable = true
k.Net.SASL.Mechanism = sarama.SASLTypeGSSAPI
k.Net.SASL.GSSAPI = sarama.GSSAPIConfig{
Expand All @@ -211,7 +218,7 @@ func newSaramaConfig(log *logp.Logger, config *kafkaConfig) (*sarama.Config, err
Username: config.Kerberos.Username,
Password: config.Kerberos.Password,
Realm: config.Kerberos.Realm,
DisablePAFXFAST: !config.EnableFAST,
DisablePAFXFAST: !enableFAST,
}

case config.Username != "":
Expand Down
6 changes: 0 additions & 6 deletions libbeat/outputs/kafka/docs/kafka.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -309,12 +309,6 @@ The ACK reliability level required from broker. 0=no response, 1=wait for local

Note: If set to 0, no ACKs are returned by Kafka. Messages might be lost silently on error.

===== `enable_krb5_fast`

beta[]

Enable Kerberos FAST authentication. This may conflict with some Active Directory installations. It is separate from the standard Kerberos settings because this flag only applies to the Kafka output. The default is `false`.

===== `ssl`

Configuration options for SSL parameters like the root CA for Kafka connections.
Expand Down
9 changes: 5 additions & 4 deletions metricbeat/metricbeat.reference.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1392,6 +1392,7 @@ output.elasticsearch:
# Kerberos realm.
#kerberos.realm: ELASTIC


# ------------------------------ Logstash Output -------------------------------
#output.logstash:
# Boolean flag to enable or disable the output module.
Expand Down Expand Up @@ -1650,10 +1651,6 @@ output.elasticsearch:
# purposes. The default is "beats".
#client_id: beats

# Enables Kerberos FAST authentication in the Kafka output. This may
# conflict with certain Active Directory configurations.
#enable_krb5_fast: false

# Use SSL settings for HTTPS.
#ssl.enabled: true

Expand Down Expand Up @@ -1732,6 +1729,10 @@ output.elasticsearch:
# Kerberos realm.
#kerberos.realm: ELASTIC

# Enables Kerberos FAST authentication. This may
# conflict with certain Active Directory configurations.
#kerberos.enable_krb5_fast: false

# -------------------------------- Redis Output --------------------------------
#output.redis:
# Boolean flag to enable or disable the output module.
Expand Down
9 changes: 5 additions & 4 deletions packetbeat/packetbeat.reference.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1089,6 +1089,7 @@ output.elasticsearch:
# Kerberos realm.
#kerberos.realm: ELASTIC


# ------------------------------ Logstash Output -------------------------------
#output.logstash:
# Boolean flag to enable or disable the output module.
Expand Down Expand Up @@ -1347,10 +1348,6 @@ output.elasticsearch:
# purposes. The default is "beats".
#client_id: beats

# Enables Kerberos FAST authentication in the Kafka output. This may
# conflict with certain Active Directory configurations.
#enable_krb5_fast: false

# Use SSL settings for HTTPS.
#ssl.enabled: true

Expand Down Expand Up @@ -1429,6 +1426,10 @@ output.elasticsearch:
# Kerberos realm.
#kerberos.realm: ELASTIC

# Enables Kerberos FAST authentication. This may
# conflict with certain Active Directory configurations.
#kerberos.enable_krb5_fast: false

# -------------------------------- Redis Output --------------------------------
#output.redis:
# Boolean flag to enable or disable the output module.
Expand Down
9 changes: 5 additions & 4 deletions winlogbeat/winlogbeat.reference.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -517,6 +517,7 @@ output.elasticsearch:
# Kerberos realm.
#kerberos.realm: ELASTIC


# ------------------------------ Logstash Output -------------------------------
#output.logstash:
# Boolean flag to enable or disable the output module.
Expand Down Expand Up @@ -775,10 +776,6 @@ output.elasticsearch:
# purposes. The default is "beats".
#client_id: beats

# Enables Kerberos FAST authentication in the Kafka output. This may
# conflict with certain Active Directory configurations.
#enable_krb5_fast: false

# Use SSL settings for HTTPS.
#ssl.enabled: true

Expand Down Expand Up @@ -857,6 +854,10 @@ output.elasticsearch:
# Kerberos realm.
#kerberos.realm: ELASTIC

# Enables Kerberos FAST authentication. This may
# conflict with certain Active Directory configurations.
#kerberos.enable_krb5_fast: false

# -------------------------------- Redis Output --------------------------------
#output.redis:
# Boolean flag to enable or disable the output module.
Expand Down
9 changes: 5 additions & 4 deletions x-pack/auditbeat/auditbeat.reference.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -650,6 +650,7 @@ output.elasticsearch:
# Kerberos realm.
#kerberos.realm: ELASTIC


# ------------------------------ Logstash Output -------------------------------
#output.logstash:
# Boolean flag to enable or disable the output module.
Expand Down Expand Up @@ -908,10 +909,6 @@ output.elasticsearch:
# purposes. The default is "beats".
#client_id: beats

# Enables Kerberos FAST authentication in the Kafka output. This may
# conflict with certain Active Directory configurations.
#enable_krb5_fast: false

# Use SSL settings for HTTPS.
#ssl.enabled: true

Expand Down Expand Up @@ -990,6 +987,10 @@ output.elasticsearch:
# Kerberos realm.
#kerberos.realm: ELASTIC

# Enables Kerberos FAST authentication. This may
# conflict with certain Active Directory configurations.
#kerberos.enable_krb5_fast: false

# -------------------------------- Redis Output --------------------------------
#output.redis:
# Boolean flag to enable or disable the output module.
Expand Down
9 changes: 5 additions & 4 deletions x-pack/filebeat/filebeat.reference.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3600,6 +3600,7 @@ output.elasticsearch:
# Kerberos realm.
#kerberos.realm: ELASTIC


# ------------------------------ Logstash Output -------------------------------
#output.logstash:
# Boolean flag to enable or disable the output module.
Expand Down Expand Up @@ -3858,10 +3859,6 @@ output.elasticsearch:
# purposes. The default is "beats".
#client_id: beats

# Enables Kerberos FAST authentication in the Kafka output. This may
# conflict with certain Active Directory configurations.
#enable_krb5_fast: false

# Use SSL settings for HTTPS.
#ssl.enabled: true

Expand Down Expand Up @@ -3940,6 +3937,10 @@ output.elasticsearch:
# Kerberos realm.
#kerberos.realm: ELASTIC

# Enables Kerberos FAST authentication. This may
# conflict with certain Active Directory configurations.
#kerberos.enable_krb5_fast: false

# -------------------------------- Redis Output --------------------------------
#output.redis:
# Boolean flag to enable or disable the output module.
Expand Down
1 change: 1 addition & 0 deletions x-pack/functionbeat/functionbeat.reference.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -880,6 +880,7 @@ output.elasticsearch:
# Kerberos realm.
#kerberos.realm: ELASTIC


# ------------------------------ Logstash Output -------------------------------
#output.logstash:
# Boolean flag to enable or disable the output module.
Expand Down
9 changes: 5 additions & 4 deletions x-pack/heartbeat/heartbeat.reference.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -772,6 +772,7 @@ output.elasticsearch:
# Kerberos realm.
#kerberos.realm: ELASTIC


# ------------------------------ Logstash Output -------------------------------
#output.logstash:
# Boolean flag to enable or disable the output module.
Expand Down Expand Up @@ -1030,10 +1031,6 @@ output.elasticsearch:
# purposes. The default is "beats".
#client_id: beats

# Enables Kerberos FAST authentication in the Kafka output. This may
# conflict with certain Active Directory configurations.
#enable_krb5_fast: false

# Use SSL settings for HTTPS.
#ssl.enabled: true

Expand Down Expand Up @@ -1112,6 +1109,10 @@ output.elasticsearch:
# Kerberos realm.
#kerberos.realm: ELASTIC

# Enables Kerberos FAST authentication. This may
# conflict with certain Active Directory configurations.
#kerberos.enable_krb5_fast: false

# -------------------------------- Redis Output --------------------------------
#output.redis:
# Boolean flag to enable or disable the output module.
Expand Down
Loading